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We propose a new type of attack on Ekert protocol in which, rather surprisingly, Eve drives a 
violation of Bell inequalities in Alice's and Bob's detectors with a mixture of separable states. She 
does so by sending correlated pulses containing several photons at frequencies where only multiple- 
photon absorptions are possible in their detectors. Whenever the photons stemming from a same 
pulse are dispatched in such a way that the number of photons is insufficient to trigger a multiple- 
photon absorption in either channel, the pulse remains undetected. We show that this simple feature 
leads to violations of Bell inequalities that can match closely those predicted for entangled states, 
even in the simplest cases of two-photon and three-photon absorptions. 



Ekert protocol .1] uses entangled states to guarantee 
the secrecy of a key distributed to two parties (Alice and 
Bob) desiring to communicate secretly through a public 
channel. Identical measurements performed on a maxi- 
mally entangled state yield a perfect correlation Q that 
can be used to produce a shared key, while its secrecy is 
guaranteed by a violation of Bell inequalities 043 mea- 
sured for non-identical measurements. 

We propose a new type of attack on this protocol, 
in which Eve controls a source of separable states with 
which she tries to convince Alice and Bob that the key 
that they extract with it is guaranteed by the observation 
of a violation of Bell inequalities, while in fact Eve has a 
full knowledge of the local states sent to them both. 



SINGLE-PHOTON ABSORPTION ATTACK 

In this first attempt, Eve is trying to approach as best 
as she can the predictions of Quantum Mechanics for 
a singlet state, but using only a mixture of separable 
states, in a single-photon absorption scenario. She will 
not succeed in getting a violation of Bell inequalities, but 
this result will serve as a basis to obtain a significantly 
better result in the case of multiple-photon absorption 

1- 

Eve prepares an ensemble of pairs of pulses for Alice 
and Bob. Each pulse contains exactly one photon that 
is linearly polarized in a direction Aj chosen by Eve. It 
can thus be described in its own Hilbert subspace "Hi by 
a two-level state of the form 



\Xi) = cosAi|0) +sinA i |l), 



(1) 



where |0) and |1) are the eigenvectors of a z with eigen- 
values — 1 and +1 respectively. The pair of pulses can 
then be described in the tensor product Hilbert space 
Wia =n 1 ^H 2 as |Aia) = |Ai) ® |A 2 ). 

Alice and Bob, who are performing local measurements 



respectively in Hi and H2, want to measure the statis- 
tical correlation of the pairs they receive from Eve when 
they perform some rotations R(9a) and R(9b) on their 
respective pulses, followed by a measurement of the ob- 
servable <7 Z . 

Since Eve wants them to obtain an as good 
(anti)correlation as possible with separable states, she 
sends orthogonal states to Alice and Bob, that is, such 
that Ai = A and A2 = A + -|. For a pair initially repre- 
sented by I A) ® I A + ?), the state after local rotations on 
each sides becomes 



ab; 



\X + 6 A ) ® |A + - + i 



a). 



(2) 



which can be expanded as 

|Aab) = cos(A + 9a) cos(A 
+ sin(A + 9a) cos(A 
+ cos(A -I- 9a) sin(A 
+ sin(A + 9a) sin(A 
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?b)|00) 
?b)|10> 
?b)|01) 
?b)|11), 



(3) 



Keeping the condition of orthogonality between Alice 
and Bob from pair to pair, Eve is randomizing the param- 
eter A associated to each pair. The state of the ensemble 
of pairs prepared by Eve can therefore be described by a 
mixture. We can characterize the probability to obtain 
a state lying between |A) and |A + dX) by a probability 
density distribution p(X) on a single probability space 
(Q,F,P). 

The mixture p describing the ensemble of pairs after 
rotation is therefore 



PAB 



p(X)dX |Aab)(Aab| 



(4) 



with J n p(X)dX = 1. 

Note that we chose to denote the polarization of the 
pulses prepared by Eve as A, a symbol that is tradition- 
ally reserved to hidden- variables, but this variable is in 
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fact hidden only from Alice and Bob, and it is not an hy- 
pothetical supplementary parameters to Quantum The- 
ory. 

After performing their respective rotation on the re- 
ceived pulses, Alice and Bob perform a joint measure- 
ment cr z ® cr z on each pair. The expectation value of this 
measurement is: 



^ab = (o" z ® <t z )pab = Tr(/3 AB <T Z ® ct z ), (5) 

with <r z = 1 0> <0| - so that 

ct z ® ct z = |00)(00| - |10)(10| - |01)(01| + |11)<11|, 

and where Tr is the trace, defined as the sum of the di- 
agonal matrix elements in any orthonormal basis, which 
in our case is Tr O — ^ j—oi^J where O is an 
operator in Hi2- 

By linearity of the trace, we can write 



with 



Eab — Poo — Pio — Pqi + Pn 



P k i=Tr(p AB \kl){kl\), 



where k and I are or 1. 

The Phi are the joint probabilities, and we can now 
express them explicitly, using Eq. (HJ), as 

Pki=Y] I p(X)dX (ij\A AB }{A AB \kl){kl\ij), 

which, since {|00), |10), |01), |11)} forms an orthonormal 
basis in T-Li2, simplifies as 



Pi 



kl 



p{X)dX \(kl\A 



AB 



(6) 



Note that, owing to the separability of |Aab) as ex- 
pressed by Eq. ^ , we can factorize the integrand in the 
above joint probability into a product, that is, 



Pm 



p(X)dX |(fc|A + A >(i|A- 
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(7) 



With Pj(A, 9) = \ (i\X + 9)\ being the probability to get 
a photon in a channel i for a local state |A) and a mea- 
surement direction 9 we can rewrite it as 



Pki = 



p{x)dXP k (x,e A )Pi(x + -,e B ), (8) 

n 1 



which can be simply interpreted as the integral on all 
possible A of the product of the probability to detect a 
photon in channel k on Alice's side for a local state |A) 
by the probability to get a photon in channel / on Bob's 
side for a local state |A + V). 



Assuming p(X) is a uniform distribution on the interval 
[0, 27r[, we can then express these integrals explicitly as 

1 r 27T 7r 
p oo = TT dAcos 2 (A + 6» A )cos 2 (A + - + B ), 

P 10 =— / dXsm 2 (X + 9 A )cos 2 (X+-+9 B ), 

Poi = tt dXcos 2 {X + 9 A )sin 2 {X+ J+0 B ), 
2vr J 2 

P u = J- / dAsin 2 (A + 9 A ) sin 2 (A + J + 9 B ), 
2tt J q 2 

which leads to 



Poo = Pn = l{2-cos2{9 A -9 B )), 
o 

P w = Poi = i(2 + cos2(0 A -0 B )), 
o 



and finally, we get 



£ab = --cos2{9 A -9 B ). 



(10) 



(11) 



This result only differs from the prediction for the sin- 
glet state by its visibility of 1/2 instead of 1, but with 
a maximum S = v2 it is clearly below 2 and therefore 
insufficient as an attack on Ekert protocol. 



TWO-PHOTON ABSORPTION ATTACK 

In the two-photon absorption attack, Eve sends also 
pairs of pulses described by a mixture of separable states 
(0| to Alice and Bob, but this time each pulse contains 
two photons instead of one. The photons inside a pulse 
share the same state: |A) for the two photons sent to 
Alice; and |A + V) for the two photons sent to Bob. We 
assume that the photons inside a pulse are independent: 
they follow the rules of Quantum Mechanics as prescribed 
by their quantum state independently of what the other 
photon is doing. 

Now, the crucial difference is that these photons are 
chosen by Eve with a lower frequency than in the single- 
photon absorption case discussed above, so that the en- 
ergy of a single photon is insufficient to trigger a click. 
Eve chooses the frequency of the photons such that the 
only way to get a click is through a two-photon absorp- 
tion. We assume for simplicity that whenever two pho- 
tons hit the same detector simultaneously, the probability 
that they trigger a click in the detector is 1. As we will 
see, this feature alone is (surprisingly) enough to lead to 
a clear violation of Bell inequalities. 

So, a click can happen in a specific channel only when 
the two photons inside the same pulse choose to go to 
that same channel. If they choose different channels, no 
two-photon absorption can occur because there is only 
one photon in each channel. So, on each side, the three 
possibilities are: 
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• Both photons go to channel — ► click in channel 
through a two-photon absorption, 

• Both photons go to channel 1 — > click in channel 1 
through a two-photon absorption, 

• One photon goes to channel 0, the other goes to 
channel 1 — > no click in either channel. 

Note that this third possibility brings us in the realm of 
the detection loophole [Ml , which is the essential rea- 
son for the appearance of the violation of Bell inequalities 
that Alice and Bob are going to obtain. It should however 
be stressed that the non detections come from the fre- 
quency threshold in the photoelectric effect alone; a fea- 
ture that is relevant in all detectors based on this effect, 
regardless of their quantum efficiency. Eve is therefore 
working in a fully Quantum Mechanical framework, with- 
out assuming anything about the detectors other than 
the existence of two-photon absorption processes at cer- 
tain frequencies, and without assuming the existence of 
any hidden- variables. 

(2) 

We want to compute the probabilities Pt, that Alice 
and Bob get a coincidence click respectively in channels 
k and I. Obviously, the third case we considered above, 
that is, when a pulse does not produce any click on ei- 
ther side, is not going lead to any coincidence. We are 
therefore only concerned with the first two cases; those 
that can produce click. 

Assuming independence between the photons, for a lo- 
cal state | A) and a measurement angle 0, on either side the 
probability that both photons from a same pulse end up 
in the same channel i is simply the square of the probabil- 
ity Pi (A, 0) to see one such photon going to this channel 
i, that is: Pf(A,0) 

So, similarly to what we had in the single photon case 
in Eq.©, the probability pff to get a click in channel 
k for Alice and in channel I for Bob in a two-photon ab- 
sorption process is therefore the integral over all possible 
state of the product of the probability P|(A, 9a) for Alice 
to get a click in channel k by the probability Pf ( A+ 1 , 0b ) 
for Bob to get a click in channel I: 



and we obtain: 



= / P(^A P£(\0 A ) Pf(X + - ,0 B ). (12) 

For a rotationally invariant source, A is uniformly dis- 
tributed on the interval [0, 2ir[, which leads to: 



p(2; _ 
■* nn — 
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2^ 



P 



2^ Jo 



dX cos 4 (A + A ) cos 4 (A + - + 0b), 



dX sin 4 (A + A ) cos 4 (A + - + B ), 



P£ } = ^J Q dX cos4 ( A + a) sin 4 (A + | + B ), 

P n = 77" 1^ dX sin4 ( A + 0a) sin 4 (A + J + , 
'2,Ti J 2 



(13) 
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(18- 
(18- 



16cos2(0 A -0E 
16cos2(0 A - E 



cos4(0 A - B ), 

cos4(0 A -0 B ). 
(14) 



Note that these four probabilities no longer add up 
to 1, because of the cases involving a non detection on 
either side or both, which are discarded by Alice and 
Bob. So, just like in a standard optical EPR experiment, 
the correlation function has to be normalized by the sum 



P (2) _ 
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and that is explicitly: 



E 



(2) 
AB 



16 cos 2(0^ 



18 + cos4(0 A -0 B ) 



which lead to a violation of Bell inequalities for 0a = 
{0,f}and B ={-!,!> of 

S m = 1| 2^2 « 2.51, 
18 

which is clearly above 2. 

Note that there is slight dependence on cos4(0a — 0b) 
that makes this correlation function differ from the 
— V cos 2(0a — 0b) expected for an entangled state (where 
V is the visibility of the correlation in a real experiment), 
but the difference is quite small and would arguably be 
quite difficult to spot for Alice and Bob even if they were 
deciding to perform a full scan of the correlation. 

The explanation for this seemingly unlikely violation of 
Bell inequalities with a mixture of separable states is that 
the sampling is unfair 12Ml4| : the sample of pulses that 
get detected do not represent fairly the pulses that were 
emitted. In the case presented in the first section, where 
each pulse contained one photon only, the probabilities to 
get a click in either channel were adding up to one, that 
is, Po(A,0) +Pi(A, 0) = 1, and were therefore treating 
all the pulses fairly. In the two-photon absorption case 
however, the probability on each side to get a click in 
either detector is 



= i(l + cos 2 (2(A + 0)), 



(16) 



which has a clear dependence on the state of the pulse A, 
and is therefore not treating all the pulses fairly. 



MULTIPLE-PHOTON ABSORPTION ATTACK 

A similar demonstration in the case of a three-photon 
absorption, with Eve sending three photons per pulse, 
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leads to 

4 3) - J PW^ Pi(\ A ) P ; 3 (A + |, B ) (17) 

which exhibits a violation of Bell inequalities as high as 
s» 3.17. Quite generally, a multi-photon absorption 
process can lead to a violation of Bell inequalities as large 
as desired within the algebraic limit of 4, the only limit 
being the order of the multiple-photon absorptions that 
Eve can drive in Alice's and Bob's detectors. 

Note that if Eve sends pulses meant to drive on one side 
a two-photon absorption and on the other a three-photon 
absorption (a feature that Eve could achieve by alterna- 
tively sending photons of different frequency to Alice and 
Bob), the relevant probabilities for the coincidences are 
of the form 

p£' 3) = [ P (\)d\Pi(\,e A )p?(\ + ^e B ) (is) 

J o 

which leads to a correlation 

^(2,3) = 1Ocos2(0a-^b) 
AB 10 + cos4(6» A - 9 B ) 

and a violation of Bell inequalities for 9 a = {0, ? } and 
Ob = {-f,f} of exactly 

s^v = 2V2. 

DISCUSSION AND POSSIBLE 
COUNTERMEASURES 

The violation of Bell inequalities observed by Alice and 
Bob is only apparent. If the non detected pulses were 
taken into account by Alice and Bob to compute the 
correlation, they would not violate any Bell inequality. 
Eve's attack is nevertheless relevant because discarding 
the pairs for which no detection was recorded on either 
side and normalizing by the sum of coincidences is pre- 
cisely how a violation of Bell inequality is observed in 
actual implementations of Ekcrt protocol with photons. 
Alice and Bob would therefore not be able to distinguish 
a genuine entangled state from this attack by simply ob- 
serving a violation of Bell inequalities. 

An unwanted feature of these attacks that could betray 
Eve's presence is that the sum of coincidences depends on 
the measurement settings 9 a and 9b- The stronger the 
violation of Bell inequalities, the stronger the visibility 
of the sum of coincidences. For instance, its visibility 
is about 0.06 in the two-photon absorption case (S^ ~ 
2.51), and it is 0.10 in the mixed case with two-photon 
absorption on one side and three-photon on the other 
side (S^V = 2V2.). 



However, Eve can remove this unwanted effect entirely 
by driving different detection patterns for Alice and Bob, 
in a similar way to what was done by Larsson [Tpj ] and 
Gisin jll| in their hidden-variable models. The simplest 
method would be to alternatively drive a single photon 
absorption on one side, and a multiple-photon absorption 
on the other side. The sampling is then always fair on the 
side driven to a single photon absorption, and the total 
number of coincidences becomes independent of the mea- 
surement angles. It is nevertheless in Alice's and Bob's 
interest to closely monitor the sum of coincidence for any 
such angle dependence, because if it does not guaran- 
tee in principle against this attack, it makes Eve's task 
more difficult by forcing her to use higher order multiple- 
photon absorptions to achieve the same violation of Bell 
inequalities. 

An obvious countermeasure against this multiple- 
photon absorption attack would be to use high-efficient 
detectors with low noise, so that undetected pulses would 
betray Eve's attack, but this is neither easy nor practical 
in an Ekert protocol with photons. Another possibil- 
ity would be to thoroughly check and guarantee that no 
multiple-photon absorption can be dominant at any fre- 
quency in the detectors that are used by Alice and Bob. 
One way to limit this possibility would be to use highly 
selective frequency filters so that only a known range of 
restricted frequencies can reach the detectors, but it has 
the drawback of reducing all the more so the global ef- 
ficiency of the channels. Last but not least, Alice and 
Bob could use our fair sampling test [lij . as it does not 
introduce any loss and can be performed locally and uni- 
laterally on either side during the production of the key. 
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